the-web-application-hackers-handbook

Index n C–C 859
session management, liberal
scope, 244–248
XSS exploiting via, 475
COPY method, 679
count() function, 348
credentials
attackers, 171
authentication vulnerability,
169–171
e-mail containing, 184
hacker’s methodology,
authentication
autogenerated, 809–810
unsafe distribution, 810–811
unsafe transmission, 810
incomplete validation, 180–181
insecure distribution, 184
insecure storage, 190–191
secret handling of, 192–193
strength, 192
validation, 193–195
web server and default,
670–671
hacker’s methodology, 846
cross-domain data capture,
515–516
CSS injection, 517–519
Firefox, 521
HTML injection, 516–517
JavaScript hijacking, 519–520
E4X, 523–524
function callbacks, 520
JSON, 521
preventing, 524
variable assignment, 522
proxy services, 529–531
cross-domain requests
JSON, 477
XMLHttpRequest, 528–529
XSS sending XML, 477–478
/crossdomain.xml, 525–526
cross-site request forgery (CSRF),
8, 244, 504–511
anti-CSRF tokens, 508–509,
516–517
XSS defeating, 510–511
authentication, 507–508
flaws
exploiting, 506–507
preventing, 508–510
real-world, 505
hacker’s methodology, 820
session management, 251
cross-site scripting (XSS), 8
attack payloads, 443–447
autocomplete, 446
escalating client-side, 447
escalation to other pages,
473–474
inducing actions, 445–446
Trojan injection, 444–445
trust relationship
exploitation, 446–447
virtual defacement, 443–444
attackers, 251
authentication, 473–474
chaining, 450–451
CSRF defeating anti-CSRF
tokens with, 510–511
database error messages, 620
defense, 28
delivery mechanisms, 447–451
in-band, 449–450
out-of-band, 450
DOM-based, 440–442
delivering, 448–449
finding and exploiting,
487–491
input validation, 497
output validation, 497–498
preventing, 496–498
reflected XSS converted into,
472–473
steps, 441
escaping, 420
exploits
cookies, 475
delivering, 473–481
JavaScript executed within
XML responses,
478–479
nonstandard request and
response content,
476–479
Referrer header, 475–476
XML requests sent crossdomain,
477–478
filters
anti-, 452, 748
blacklist-based, 451–452
IE, 479–481
web browsers, 479–481
HTML tag pairs, 422
IE filter, 479–481
JavaScript, 436–438
non-HTTP services, 562–563
NULL bytes, 460
POST request changed to GET
request, 474–475
prevalence, 432
preventing, 492–498
real-world, 442–443
reflected, 434–438
Apache, 442
cookies, 437–438
defensive filters, 455–456
delivering, 448–449
DOM XSS converted from,
472–473
exploiting, 435–438, 474
finding and exploiting,
452–481
hacker’s methodology,
829–830
HTML limitations, 495–496
IE, 435
input insertion, 495
input validation, 492–493
length limits, 471–473
output validation, 493–495
preventing, 492–496
“remember me” function, 437
sanitizing filters, 468–471
signature-based filters,
455–456
steps, 436–437
stored XSS compared to,
439–440
user input testing, 453
user input testing to
introduce script,
454–455
security evolution, 433
session token vulnerabilities,
243–244
source code, 704–705
stored, 438–440
attacker steps, 438–439
delivering, 449–450
e-mail testing, 483–484
finding and exploiting,
481–487
HTML limitations, 495–496
input insertion, 495
input validation, 492–493
MySpace, 442–443, 446
output validation, 493–495
preventing, 492–496
reflected XSS compared to,
439–440
search function, 439
uploaded files testing,
484–487
vulnerabilities
identifying, 451–452
low-risk, 451
varieties, 433–442
XSS Shell, 566
cryptographic algorithms, 687
CSRF. See cross-site request
forgery